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Amendments to the Claims: 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

Please amend the claims as follows: 

1. (Currently Amended) A method comprising: 

presenting a graphical user interface (GUI) for a capture system, wherein the GUI 
comprises one or more views including: 

a search editor view to enable parameters of a search of tags of objects 
captured by the capture system to be defined, the capture system configured to 
intercept data from data streams, reconstruct ne twork transmitted objects thedata, 
and store network transmitted objects according to a capture rule that defines 
which objects are to be captured by the capture system, wherein each tag is 
associated with at least one captured object and includes relevant information that 
describes the at least one object; and 

a capture rule view to enable parameters of the capture rule to be defined. 

2. (Previously Presented) The method of claim 1, wherein the parameters definable 
through the search editor view include both indexed and non-indexed search criteria. 

3. (Previously Presented) The method of claim 1, wherein the definable search editor 
view parameters include one or more of a plurality of search criteria, the search criteria 
comprising: 

a content type, 
a protocol, 
a keywords, and 
a word pattern. 
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4. (Previously Presented) The method of claim 3, wherein the search criteria further 
include a source address, a destination address, a size range, and a temporal range. 

5. (Previously Presented) The method of claim 1, wherein the definable parameters of 
the search editor view specify one or more of a plurality of search criteria, the search 
criteria comprising: 

an email source, 
an email destination, 
an email carbon copy, 
an email subject, and 
message keywords. 



6-21. (Canceled) 

22. (Withdrawn) A capture system comprising: 

a packet capture module to extract data packets from a data stream; 
an object assembly module to reconstruct a flow of at least one object from the extracted 
data packets; 

an object classification module to classify the at least one object and to deconstruct 
the flow into at least one object; 

an object store module to store the at least one object; and 

a graphical user Interface (GUI) module to provide a GUI including a search view to 
allow for the authoring, editing, scheduling, and viewing of searches of stored tags. 
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23. (Withdrawn) A method comprising: 

capturing data packets from a data stream; 

reconstructing said data packets into a copy of an original object; 

determining if the copy of the original object should be stored based on a capture 

rule; 

generating a tag for the copy of the original object; 

storing the copy of the original object and the tag if it is determined that the copy of 
the original object should be stored based on the capture rule; 

discarding the copy of the original object if it is determined that the copy of the 
original object should not be stored based on the capture rule; and 

generating a graphical user interface (GUI), the GUI including a search view to allow 
for the authoring, editing, scheduling, and viewing of searches of stored tags. 

24. (Withdrawn) The method of claim 23, further comprising: 

discarding the tag if it is determined that the copy of the original object should not 
be stored based on the capture rule. 

25. (Previously Presented) The method of claim 1, wherein the search is of tags of 
stored objects. 

26. (Canceled) 
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27. (Currently Amended) A computer readable medium having stored thereon data 
representing instructions that, when executed by a processor, cause the processor to 
perform operations comprising: 

presenting a graphical user interface (GUI) for a capture system, wherein the GUI 

comprises one or more views including: 

a search editor view to enable parameters of a search of tags of objects 
captured by the capture system to be defined, the capture system contoured , to 
intercept data from data streams, reconstruct network transmitted objects, and 
store network transmitted objects according to a capture rule that defines which 
objects are to be captured by tho mpture system, wherein each tag is associated 
with at least one captured object and includes relevant information that describes 

the at least one object; 

a capture rule view to enable parameters of the capture rule to be defined. 

28. (Previously Presented) The computer readable medium of claim 27, wherein the 
parameters definable through the search editor view include both indexed and non-indexed 
search criteria. 

29. (Previously Presented) The computer readable medium of claim 27, wherein the 
definable search editor view parameters include one or more of a plurality of search criteria, 
the search criteria comprising: 

a content type, 
a protocol, 
a keyword, and 
a word pattern. 

30. (Previously Presented) The computer readable medium of claim 29, wherein the 
search criteria further include a source address, a destination address, a size range, and a 
temporal range. 
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31. (Previously Presented) The computer readable medium of claim 27, wherein the 
definable parameters of the search editor view specify one or more of a plurality of search 
criteria, the search criteria comprising: 

an email source, 
an email destination, 
an email carbon copy, 
an email subject, and 
message keywords. 

32. {Previously Presented) The computer readable medium of claim 27, wherein the 
search is of tags of stored objects. 

33. {Previously Presented) The method of claim 1, wherein the relevant information 
that describes the at least one object includes one or more of a plurality of fields, the fields 

comprising: 

a protocol, 

an instance, 

a content type, 

an encoding, 

a capture rule, 

an object signature, and 

a tag signature. 

34. (Cancelled) 
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